OX Software GmbH OX App Suite

• CVE-2023-29047 Medium 5.3 Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements. An attacker with access to the adjacent ne 0.3%
• CVE-2023-29046 Medium 4.3 Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged. Some connections use user-controlled endpoin 0.6%
• CVE-2023-29045 Medium 5.4 Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users t 0.4%
• CVE-2023-29044 Medium 5.4 Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collabor 0.4%
• CVE-2023-29043 Medium 6.1 Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed when editing a document. Script code embedded in malicious do 0.4%
• CVE-2023-26456 Medium 5.4 Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before processing it at the user interface, allowing for indirect cross-site scripting 0.4%
• CVE-2023-26455 Medium 5.6 RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI service to modify calendar items using RMI. R 0.2%
• CVE-2023-26454 High 7.6 Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconver 0.4%
• CVE-2023-26453 High 7.6 Requests to cache an image could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks of the imageconverter se 0.4%
• CVE-2023-26452 High 7.6 Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to adjacent networks 0.4%
• CVE-2023-26451 High 7.5 Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be use 1.2%
• CVE-2023-26450 Medium 5.4 The "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hija 0.7%
• CVE-2023-26449 Medium 5.4 The "OX Chat" web service did not specify a media-type when processing responses by external resources. Malicious script code can be executed within the victims context. This can lead to session hijac 0.7%
• CVE-2023-26448 Medium 5.4 Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. Malicious script code can be executed within the victims context. This can le 0.7%
• CVE-2023-26447 Medium 5.4 The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not get escaped before being added to DOM. Malicious script code c 0.7%
• CVE-2023-26446 Medium 5.4 The users clientID at "application passwords" was not sanitized or escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hijacki 0.7%
• CVE-2023-26445 Medium 5.4 Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. Malicious script code can be executed within the victims cont 0.7%
• CVE-2023-26443 Medium 5.5 Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abused to trigger benign SQL Exceptions but could poten 0.8%
• CVE-2023-26442 Low 3.2 In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. An attacker with access to a local or restricted network with the ca 0.4%
• CVE-2023-26441 Medium 5.7 Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources. An attacker with access to the database and a local or restricted 0.4%
• CVE-2023-26440 High 7.1 The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be executed when creating new cache groups. Attackers with acces 0.4%
• CVE-2023-26439 High 7.6 The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL statement. Attackers with access to a local or restricted ne 0.4%
• CVE-2023-26438 Medium 4.3 External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cache. Attackers that were timing DNS cache expiry correctly 0.6%
• CVE-2023-26430 Low 3.5 Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE extension that are not allowed by App Suite or to inject 0.8%
• CVE-2023-26436 High 7.1 Attackers with access to the "documentconverterws" API were able to inject serialized Java objects, that were not properly checked during deserialization. Access to this API endpoint is restricted to 1.3%
• CVE-2023-26435 Medium 5.0 It was possible to call filesystem and network references using the local LibreOffice instance using manipulated ODT documents. Attackers could discover restricted network topology and services as wel 0.8%
• CVE-2023-26434 Medium 4.3 When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue POP3 service could trigger requests that lead to e 1.1%
• CVE-2023-26433 Medium 4.3 When adding an external mail account, processing of IMAP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue IMAP service could trigger requests that lead to e 1.1%
• CVE-2023-26432 Medium 4.3 When adding an external mail account, processing of SMTP "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue SMTP service could trigger requests that lead to e 1.1%
• CVE-2023-26431 Medium 5.0 IPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt is made. Attackers with access to user accounts could use this to bypass existing deny-list functional 0.8%
• CVE-2023-26429 Low 3.5 Control characters were not removed when exporting user feedback content. This allowed attackers to include unexpected content via user feedback and potentially break the exported data structure. We n 0.8%
• CVE-2023-26428 Medium 6.5 Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context. Signatures of other users could be read even though they are not explicitl 1.0%
• CVE-2023-26427 Low 3.2 Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated the default permissions for noreply.properties set during pac 0.3%